Name no package the virtualenv gets (closes #133)

virtualenv adds setuptools to a new virtualenv only on Python before
3.12, so the policy now says "the packages virtualenv puts into" the
virtualenv instead of naming pip and setuptools.

Model: opus-5-5

prompts/REPO_POLICIES.md

@@ -391,12 +391,12 @@ style conventions are in separate documents:
       the lockfile is out of date with `Pipfile`.
     - A kept layer holds the same pipenv, the same dependencies of pipenv and
       the same lockfile packages that a new install would, because each was
-      checked against its hash. The pip and setuptools inside the virtualenv
-      that pipenv creates are the same too: the `virtualenv` package, one of
-      pipenv's dependencies, copies them from wheels it ships, and its hash
-      covers those wheels. Any system packages the step installed are not pinned
-      by hash: the layer keeps the versions the package manager gave when the
-      layer was built, and a new install may get newer ones.
+      checked against its hash. The packages `virtualenv` puts into the
+      virtualenv that pipenv creates are the same too: the `virtualenv` package,
+      one of pipenv's dependencies, copies them from wheels it ships, and its
+      hash covers those wheels. Any system packages the step installed are not
+      pinned by hash: the layer keeps the versions the package manager gave when
+      the layer was built, and a new install may get newer ones.
     - The packages are kept in a layer rather than a cache mount for the reason
       Go's modules are: a cache mount is shared by every build on the host, and
       nothing checks its files again.